Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    6.2.2
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.0.0
    5.6.0
    5.4.0
    5.2.0
    5.0.0

    firewall profile-protocol-options

    Configure protocol options.

      config firewall profile-protocol-options
      Description: Configure protocol options.
      edit <name>
          set comment {var-string}
          set replacemsg-group {string}
          set oversize-log [disable|enable]
          set switching-protocols-log [disable|enable]
          config http
              Description: Configure HTTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set comfort-interval {integer}
              set comfort-amount {integer}
              set range-block [disable|enable]
              set strip-x-forwarded-for [disable|enable]
              set post-lang {option1}, {option2}, ...
              set fortinet-bar [enable|disable]
              set fortinet-bar-port {integer}
              set streaming-content-bypass [enable|disable]
              set switching-protocols [bypass|block]
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set stream-based-uncompressed-limit {integer}
              set scan-bzip2 [enable|disable]
              set block-page-status-code {integer}
              set retry-count {integer}
              set tcp-window-type [system|static|...]
              set tcp-window-minimum {integer}
              set tcp-window-maximum {integer}
              set tcp-window-size {integer}
              set ssl-offloaded [no|yes]
          end
          config ftp
              Description: Configure FTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set comfort-interval {integer}
              set comfort-amount {integer}
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config imap
              Description: Configure IMAP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config mapi
              Description: Configure MAPI protocol options.
              set ports {integer}
              set status [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
          end
          config pop3
              Description: Configure POP3 protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config smtp
              Description: Configure SMTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set server-busy [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config nntp
              Description: Configure NNTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
          end
          config ssh
              Description: Configure SFTP and SCP protocol options.
              set options {option1}, {option2}, ...
              set comfort-interval {integer}
              set comfort-amount {integer}
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
          end
          config dns
              Description: Configure DNS protocol options.
              set ports {integer}
              set status [enable|disable]
          end
          config cifs
              Description: Configure CIFS protocol options.
              set ports {integer}
              set status [enable|disable]
          end
          config mail-signature
              Description: Configure Mail signature.
              set status [disable|enable]
              set signature {string}
          end
          set rpc-over-http [enable|disable]
      next
  end

    config firewall profile-protocol-options

    Parameter Name Description Type Size
    comment Optional comments. var-string Maximum length: 255
    replacemsg-group Name of the replacement message group to be used string Maximum length: 35
    oversize-log Enable/disable logging for antivirus oversize file blocking.
    disable: Disable logging for antivirus oversize file blocking.
    enable: Enable logging for antivirus oversize file blocking.
    		 option -
    switching-protocols-log Enable/disable logging for HTTP/HTTPS switching protocols.
    disable: Disable logging for HTTP/HTTPS switching protocols.
    enable: Enable logging for HTTP/HTTPS switching protocols.
    		 option -
    rpc-over-http Enable/disable inspection of RPC over HTTP.
    enable: Enable inspection of RPC over HTTP.
    disable: Disable inspection of RPC over HTTP.
    		 option -

    config http

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 80). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    clientcomfort: Prevent client timeout.
    servercomfort: Prevent server timeout.
    oversize: Block oversized file/email.
    chunkedbypass: Bypass chunked transfer encoded sites.
    		 option -
    comfort-interval Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10). integer Minimum value: 1 Maximum value: 900
    comfort-amount Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1). integer Minimum value: 1 Maximum value: 65535
    range-block Enable/disable blocking of partial downloads.
    disable: Disable blocking of partial downloads.
    enable: Enable blocking of partial downloads.
    		 option -
    strip-x-forwarded-for Enable/disable stripping of HTTP X-Forwarded-For header.
    disable: Disable changing of HTTP X-Forwarded-For header.
    enable: Enable replacement of X-Forwarded-For value with 1.1.1.1.
    		 option -
    post-lang ID codes for character sets to be used to convert to UTF-8 for banned words and DLP on HTTP posts (maximum of 5 character sets).
    jisx0201: Japanese Industrial Standard 0201.
    jisx0208: Japanese Industrial Standard 0208.
    jisx0212: Japanese Industrial Standard 0212.
    gb2312: Guojia Biaozhun 2312 (simplified Chinese).
    ksc5601-ex: Wansung Korean standard 5601.
    euc-jp: Extended Unicode Japanese.
    sjis: Shift Japanese Industrial Standard.
    iso2022-jp: ISO 2022 Japanese.
    iso2022-jp-1: ISO 2022-1 Japanese.
    iso2022-jp-2: ISO 2022-2 Japanese.
    euc-cn: Extended Unicode Chinese.
    ces-gbk: Extended GB2312 (simplified Chinese).
    hz: Hanzi simplified Chinese.
    ces-big5: Big-5 traditional Chinese.
    euc-kr: Extended Unicode Korean.
    iso2022-jp-3: ISO 2022-3 Japanese.
    iso8859-1: ISO 8859 Part 1 (Western European).
    tis620: Thai Industrial Standard 620.
    cp874: Code Page 874 (Thai).
    cp1252: Code Page 1252 (Western European Latin).
    cp1251: Code Page 1251 (Cyrillic).
    		 option -
    fortinet-bar Enable/disable Fortinet bar on HTML content.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    fortinet-bar-port Port for use by Fortinet Bar (1 - 65535, default = 8011). integer Minimum value: 1 Maximum value: 65535
    streaming-content-bypass Enable/disable bypassing of streaming content from buffering.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    switching-protocols Bypass from scanning, or block a connection that attempts to switch protocol.
    bypass: Bypass connections when switching protocols.
    block: Block connections when switching protocols.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    stream-based-uncompressed-limit Maximum stream-based uncompressed data size that will be scanned (MB, 0 = unlimited (default). Stream-based uncompression used only under certain conditions.). integer Minimum value: 0 Maximum value: 4294967295
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    block-page-status-code Code number returned for blocked HTTP pages (non-FortiGuard only) (100 - 599, default = 403). integer Minimum value: 100 Maximum value: 599
    retry-count Number of attempts to retry HTTP connection (0 - 100, default = 0). integer Minimum value: 0 Maximum value: 100
    tcp-window-type Specify type of TCP window to use for this protocol.
    system: Use system default TCP window size for this protocol (Default).
    static: Manually specify TCP window size.
    dynamic: Vary TCP window size based on available memory, within limits.
    		 option -
    tcp-window-minimum Minimum dynamic TCP window size (default = 128KB). integer Minimum value: 65536 Maximum value: 1048576
    tcp-window-maximum Maximum dynamic TCP window size (default = 8MB). integer Minimum value: 1048576 Maximum value: 33554432
    tcp-window-size Set TCP static window size (default = 256KB). integer Minimum value: 65536 Maximum value: 33554432
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config ftp

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 21). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    clientcomfort: Prevent client timeout.
    oversize: Block oversized file/email.
    splice: Enable splice mode.
    bypass-rest-command: Bypass REST command.
    bypass-mode-command: Bypass MODE command.
    		 option -
    comfort-interval Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10). integer Minimum value: 1 Maximum value: 900
    comfort-amount Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1). integer Minimum value: 1 Maximum value: 65535
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config imap

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 143). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config mapi

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 135). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config pop3

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 110). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config smtp

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 25). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    splice: Enable splice mode.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    server-busy Enable/disable SMTP server busy when server not available.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config nntp

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 119). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    oversize: Block oversized file/email.
    splice: Enable splice mode.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config ssh

    Parameter Name Description Type Size
    options One or more options that can be applied to the session.
    oversize: Block oversized file/email.
    clientcomfort: Prevent client timeout.
    servercomfort: Prevent server timeout.
    		 option -
    comfort-interval Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10). integer Minimum value: 1 Maximum value: 900
    comfort-amount Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1). integer Minimum value: 1 Maximum value: 65535
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config dns

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 53). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config cifs

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 445). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config mail-signature

    Parameter Name Description Type Size
    status Enable/disable adding an email signature to SMTP email messages as they pass through the FortiGate.
    disable: Disable mail signature.
    enable: Enable mail signature.
    		 option -
    signature Email signature to be added to outgoing email (if the signature contains spaces, enclose with quotation marks). string Maximum length: 1023
    Previous
    Next

    firewall profile-protocol-options

    Configure protocol options.

      config firewall profile-protocol-options
      Description: Configure protocol options.
      edit <name>
          set comment {var-string}
          set replacemsg-group {string}
          set oversize-log [disable|enable]
          set switching-protocols-log [disable|enable]
          config http
              Description: Configure HTTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set comfort-interval {integer}
              set comfort-amount {integer}
              set range-block [disable|enable]
              set strip-x-forwarded-for [disable|enable]
              set post-lang {option1}, {option2}, ...
              set fortinet-bar [enable|disable]
              set fortinet-bar-port {integer}
              set streaming-content-bypass [enable|disable]
              set switching-protocols [bypass|block]
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set stream-based-uncompressed-limit {integer}
              set scan-bzip2 [enable|disable]
              set block-page-status-code {integer}
              set retry-count {integer}
              set tcp-window-type [system|static|...]
              set tcp-window-minimum {integer}
              set tcp-window-maximum {integer}
              set tcp-window-size {integer}
              set ssl-offloaded [no|yes]
          end
          config ftp
              Description: Configure FTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set comfort-interval {integer}
              set comfort-amount {integer}
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config imap
              Description: Configure IMAP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config mapi
              Description: Configure MAPI protocol options.
              set ports {integer}
              set status [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
          end
          config pop3
              Description: Configure POP3 protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config smtp
              Description: Configure SMTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
              set server-busy [enable|disable]
              set ssl-offloaded [no|yes]
          end
          config nntp
              Description: Configure NNTP protocol options.
              set ports {integer}
              set status [enable|disable]
              set inspect-all [enable|disable]
              set options {option1}, {option2}, ...
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
          end
          config ssh
              Description: Configure SFTP and SCP protocol options.
              set options {option1}, {option2}, ...
              set comfort-interval {integer}
              set comfort-amount {integer}
              set oversize-limit {integer}
              set uncompressed-oversize-limit {integer}
              set uncompressed-nest-limit {integer}
              set scan-bzip2 [enable|disable]
          end
          config dns
              Description: Configure DNS protocol options.
              set ports {integer}
              set status [enable|disable]
          end
          config cifs
              Description: Configure CIFS protocol options.
              set ports {integer}
              set status [enable|disable]
          end
          config mail-signature
              Description: Configure Mail signature.
              set status [disable|enable]
              set signature {string}
          end
          set rpc-over-http [enable|disable]
      next
  end

    config firewall profile-protocol-options

    Parameter Name Description Type Size
    comment Optional comments. var-string Maximum length: 255
    replacemsg-group Name of the replacement message group to be used string Maximum length: 35
    oversize-log Enable/disable logging for antivirus oversize file blocking.
    disable: Disable logging for antivirus oversize file blocking.
    enable: Enable logging for antivirus oversize file blocking.
    		 option -
    switching-protocols-log Enable/disable logging for HTTP/HTTPS switching protocols.
    disable: Disable logging for HTTP/HTTPS switching protocols.
    enable: Enable logging for HTTP/HTTPS switching protocols.
    		 option -
    rpc-over-http Enable/disable inspection of RPC over HTTP.
    enable: Enable inspection of RPC over HTTP.
    disable: Disable inspection of RPC over HTTP.
    		 option -

    config http

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 80). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    clientcomfort: Prevent client timeout.
    servercomfort: Prevent server timeout.
    oversize: Block oversized file/email.
    chunkedbypass: Bypass chunked transfer encoded sites.
    		 option -
    comfort-interval Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10). integer Minimum value: 1 Maximum value: 900
    comfort-amount Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1). integer Minimum value: 1 Maximum value: 65535
    range-block Enable/disable blocking of partial downloads.
    disable: Disable blocking of partial downloads.
    enable: Enable blocking of partial downloads.
    		 option -
    strip-x-forwarded-for Enable/disable stripping of HTTP X-Forwarded-For header.
    disable: Disable changing of HTTP X-Forwarded-For header.
    enable: Enable replacement of X-Forwarded-For value with 1.1.1.1.
    		 option -
    post-lang ID codes for character sets to be used to convert to UTF-8 for banned words and DLP on HTTP posts (maximum of 5 character sets).
    jisx0201: Japanese Industrial Standard 0201.
    jisx0208: Japanese Industrial Standard 0208.
    jisx0212: Japanese Industrial Standard 0212.
    gb2312: Guojia Biaozhun 2312 (simplified Chinese).
    ksc5601-ex: Wansung Korean standard 5601.
    euc-jp: Extended Unicode Japanese.
    sjis: Shift Japanese Industrial Standard.
    iso2022-jp: ISO 2022 Japanese.
    iso2022-jp-1: ISO 2022-1 Japanese.
    iso2022-jp-2: ISO 2022-2 Japanese.
    euc-cn: Extended Unicode Chinese.
    ces-gbk: Extended GB2312 (simplified Chinese).
    hz: Hanzi simplified Chinese.
    ces-big5: Big-5 traditional Chinese.
    euc-kr: Extended Unicode Korean.
    iso2022-jp-3: ISO 2022-3 Japanese.
    iso8859-1: ISO 8859 Part 1 (Western European).
    tis620: Thai Industrial Standard 620.
    cp874: Code Page 874 (Thai).
    cp1252: Code Page 1252 (Western European Latin).
    cp1251: Code Page 1251 (Cyrillic).
    		 option -
    fortinet-bar Enable/disable Fortinet bar on HTML content.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    fortinet-bar-port Port for use by Fortinet Bar (1 - 65535, default = 8011). integer Minimum value: 1 Maximum value: 65535
    streaming-content-bypass Enable/disable bypassing of streaming content from buffering.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    switching-protocols Bypass from scanning, or block a connection that attempts to switch protocol.
    bypass: Bypass connections when switching protocols.
    block: Block connections when switching protocols.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    stream-based-uncompressed-limit Maximum stream-based uncompressed data size that will be scanned (MB, 0 = unlimited (default). Stream-based uncompression used only under certain conditions.). integer Minimum value: 0 Maximum value: 4294967295
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    block-page-status-code Code number returned for blocked HTTP pages (non-FortiGuard only) (100 - 599, default = 403). integer Minimum value: 100 Maximum value: 599
    retry-count Number of attempts to retry HTTP connection (0 - 100, default = 0). integer Minimum value: 0 Maximum value: 100
    tcp-window-type Specify type of TCP window to use for this protocol.
    system: Use system default TCP window size for this protocol (Default).
    static: Manually specify TCP window size.
    dynamic: Vary TCP window size based on available memory, within limits.
    		 option -
    tcp-window-minimum Minimum dynamic TCP window size (default = 128KB). integer Minimum value: 65536 Maximum value: 1048576
    tcp-window-maximum Maximum dynamic TCP window size (default = 8MB). integer Minimum value: 1048576 Maximum value: 33554432
    tcp-window-size Set TCP static window size (default = 256KB). integer Minimum value: 65536 Maximum value: 33554432
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config ftp

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 21). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    clientcomfort: Prevent client timeout.
    oversize: Block oversized file/email.
    splice: Enable splice mode.
    bypass-rest-command: Bypass REST command.
    bypass-mode-command: Bypass MODE command.
    		 option -
    comfort-interval Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10). integer Minimum value: 1 Maximum value: 900
    comfort-amount Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1). integer Minimum value: 1 Maximum value: 65535
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config imap

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 143). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config mapi

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 135). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config pop3

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 110). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config smtp

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 25). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    fragmail: Pass fragmented email.
    oversize: Block oversized file/email.
    splice: Enable splice mode.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    server-busy Enable/disable SMTP server busy when server not available.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    ssl-offloaded SSL decryption and encryption performed by an external device.
    no: SSL decryption and encryption performed by FortiGate when deep-inspection is enabled.
    yes: SSL decryption and encryption performed by an external device.
    		 option -

    config nntp

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 119). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    inspect-all Enable/disable the inspection of all ports for the protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -
    options One or more options that can be applied to the session.
    oversize: Block oversized file/email.
    splice: Enable splice mode.
    		 option -
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config ssh

    Parameter Name Description Type Size
    options One or more options that can be applied to the session.
    oversize: Block oversized file/email.
    clientcomfort: Prevent client timeout.
    servercomfort: Prevent server timeout.
    		 option -
    comfort-interval Period of time between start, or last transmission, and the next client comfort transmission of data (1 - 900 sec, default = 10). integer Minimum value: 1 Maximum value: 900
    comfort-amount Amount of data to send in a transmission for client comforting (1 - 65535 bytes, default = 1). integer Minimum value: 1 Maximum value: 65535
    oversize-limit Maximum in-memory file size that can be scanned (1 - 383 MB, default = 10). integer Minimum value: 1 Maximum value: 6446
    uncompressed-oversize-limit Maximum in-memory uncompressed file size that can be scanned (0 - 383 MB, 0 = unlimited, default = 10). integer Minimum value: 0 Maximum value: 6446
    uncompressed-nest-limit Maximum nested levels of compression that can be uncompressed and scanned (2 - 100, default = 12). integer Minimum value: 2 Maximum value: 100
    scan-bzip2 Enable/disable scanning of BZip2 compressed files.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config dns

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 53). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config cifs

    Parameter Name Description Type Size
    ports Ports to scan for content (1 - 65535, default = 445). integer Minimum value: 1 Maximum value: 65535
    status Enable/disable the active status of scanning for this protocol.
    enable: Enable setting.
    disable: Disable setting.
    		 option -

    config mail-signature

    Parameter Name Description Type Size
    status Enable/disable adding an email signature to SMTP email messages as they pass through the FortiGate.
    disable: Disable mail signature.
    enable: Enable mail signature.
    		 option -
    signature Email signature to be added to outgoing email (if the signature contains spaces, enclose with quotation marks). string Maximum length: 1023
    Previous
    Next